CVEs published in January 2025
4,247 vulnerabilities, 364 critical, 17 exploited.
- ibm control centerIBM Control Center information disclosure4.3 Medium
- importwp import wp, jcollings import wp – export and import csv and xml files to wordpress +1 moreImport WP – Export and Import CSV and XML files to WordPress <= 2.14.5 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory7.5 High
- badhonrocks divi carousel free (divi5 support), elegantthemes carousel maker for divi +1 moreDivi Carousel Lite <= 2.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Carousel and Logo Carousel Widgets6.4 Medium
- bitapps contact form builder, bitpressadmin bit form – custom contact form, multi step, conversational form & payment form builder +1 moreContact Form by Bit Form <= 2.17.4 - Authenticated (Administrator+) Server-Side Request Forgery3.8 Low
- ibsofts boom festBoom Fest <= 2.2.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update4.3 Medium
- nmedia gohero store customizer for woocommerceGoHero Store Customizer for WooCommerce <= 3.5 - Missing Authorization to Unuthenticated Settings Update4.3 Medium
- paulrosen abc notationABC Notation <= 6.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- paulrosen abc notationABC Notation <= 6.1.3 - Authenticated (Contributor+) Arbitrary File Read6.5 Medium
- kainelabs youzify, youzify – buddypress community, user profile, social network & membership plugin for wordpress +1 moreYouzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.3.3 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update (save_addon_key_li…6.5 Medium
- jackdewey bilingual linkerBilingual Linker <= 2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- coreymcollins etsy importerEtsy Importer <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- dineshrawat masy galleryMasy Gallery <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- hk1993 wp contact form7 email spam blocker, mr-kalathiya wp contect form7 email spam blocker +1 moreWP Contact Form7 Email Spam Blocker <= 1.0.0 - Reflected Cross-Site Scripting6.1 Medium
- broadstreetads broadstreetBroadstreet <= 1.51.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via zone Parameter6.4 Medium
- kainelabs youzify, youzify – buddypress community, user profile, social network & membership plugin for wordpress +1 moreYouzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.3.4 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update4.3 Medium
- kainelabs youzify, youzify – buddypress community, user profile, social network & membership plugin for wordpress +1 moreYouzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress By KaineLabs <= 1.3.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Review Deletion4.3 Medium
- thimpress learnpress, learnpress – wordpress lms plugin for create and sell online courses +1 moreLearnPress – WordPress LMS Plugin <= 4.2.7.5 - Authenticated (LP Instructor+) Stored Cross-Site Scripting via Lesson Name6.4 Medium
- dotrex power ups for elementorPower Ups for Elementor <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- notice faq, qchantelnotice wordpress seo friendly accordion faq with ai assisted content generation +1 moreWordPress SEO Friendly Accordion FAQ with AI assisted content generation <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- shazahm1hotmailcom connections business directoryConnections Business Directory <= 10.4.66 - Authenticated (Admin+) Arbitrary Directory Deletion6.5 Medium
- brodosnet brodos.net onlineshop pluginbrodos.net Onlineshop Plugin <= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- arunbasillal ask me anything (anonymously)Ask Me Anything (Anonymously) <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- nebojsadabic target video easy publishTarget Video Easy Publish <= 3.8.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting6.1 Medium
- mastowkir notice board by towkirNOTICE BOARD BY TOWKIR <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- skyverge custom product tabs lite for woocommerceCustom Product Tabs Lite for WooCommerce <= 1.9.0 - Authenticated (Shop Manager+) PHP Object Injection7.2 High
- flexmls flexmls® idx pluginFlexmls® IDX Plugin <= 3.14.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via API parameters6.4 Medium
- plethoraplugins plethora plugins tabs + accordionsPlethora Plugins Tabs + Accordions <= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via anchor6.4 Medium
- themerex addonsThemeREX Addons <= 2.33.0 - Authenticated (Contributor+) Local File Inclusion via Shortcode8.8 High
- 7-zip, netapp active iq unified manager +1 more7-Zip Mark-of-the-Web Bypass Vulnerability7.0 High
- linearoy linearLinear <= 2.8.1 - Cross-Site Request Forgery to Cache Reset4.3 Medium
- iqonic wpbookitWPBookit <= 1.6.9 - Unauthenticated Arbitrary File Upload9.8 Critical
- @clerk nuxtOpening a malicious website while running a Nuxt dev server could allow read-only access to code5.3 Medium
- @clerk nuxtOpening a malicious website while running a Nuxt dev server could allow read-only access to code5.3 Medium
kamailioOSS-FuzzHeap-buffer-overflow in extract_candidateNo scoreapache-poiOSS-FuzzSecurity exception in java.base/java.util.Arrays.copyOfRangeNo score- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Spoofing Vulnerability5.4 Medium
- campcodes school management softwareCampCodes School Management Software Notice Board Page notice-list cross site scripting5.3 Medium
- dcatadmin dcat adminDcat-Admin Roles Page roles cross site scripting5.1 Medium
- fumiao opencmsfumiao opencms Add Model Management Page addOrUpdate cross site scripting5.3 Medium
- rise group mode temp cpuRise Group Rise Mode Temp CPU Startup CRYPTBASE.dll untrusted search path8.5 High
uniapiPyPIuniapi version 1.0.7 contained an information harvesting script.No score- joeybling bootplusJoeyBling bootplus admin.html cross site scripting5.1 Medium
- joeybling bootplusJoeyBling bootplus QrCodeController.java qrCode redirect6.9 Medium
- hl7 fhir-ig-publisherThe HL7 FHIR IG publisher may potentially expose GitHub repo user and credential information4.2 Medium
- hl7 fhir-ig-publisherXXE vulnerability in XSLT parsing in `org.hl7.fhir.publisher`8.6 High
- joeybling bootplusJoeyBling bootplus QrCodeController.java qrCode resource consumption6.9 Medium
- joeybling bootplusJoeyBling bootplus SysFileController.java path traversal5.3 Medium
- github codeql-actionCodeQL GitHub Action failed workflow writes GitHub PAT to debug artifacts7.1 High
- joeybling bootplusJoeyBling bootplus SysFileController.java unrestricted upload5.3 Medium
- nks email subscription popupWordPress Email Subscription Popup plugin <= 1.2.23 - SQL Injection vulnerability7.6 High
- Show moreLoading…